CVE-2023-49105 ownCloud Improper Authentication
Attackers can access, modify, or delete files without authentication if the victim lacks a signing key, affecting ownCloud server deployments.
- Exploited in the wild
- Since 27 Aug 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-49105?
CVE-2023-49105 is a critical authentication bypass vulnerability in Owncloud Owncloud Server, published on 21 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
Weakness: CWE-287
Which versions are affected by CVE-2023-49105?
It affects 1 product.
Products include Owncloud Owncloud Server.
How do I fix CVE-2023-49105?
No fix has been published for CVE-2023-49105 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 30 Aug 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-49105 being exploited?
Yes. Attackers have exploited CVE-2023-49105 in the wild since at least 27 Aug 2026.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Owncloud Owncloud Server
Sources
Also known as GHSA-585g-f852-v6p4.